Summary The Air France Boeing 747-428 aircraft (registration F-GITC, serial number 25344) departed Paris Charles de Gaulle International Airport, France at 1456 Coordinated Universal Time (UTC) as AFR346 on a scheduled flight to Montral/Pierre Elliott Trudeau International Airport with 491passengers and 18crew members on board. The aircraft landed on Runway24R at 2145UTC. During the rollout, the aircraft veered to the right and the crew attempted to stop the turn while applying maximum braking. The aircraft stopped with the nose wheel landing gear 26feet past the right edge of the runway, while the main landing gear remained on the runway. There were no injuries and the passengers disembarked using passenger transfer vehicles. The aircraft was not damaged and a post-flight inspection revealed no system malfunction. Ce rapport est galement disponible en franais. Other Factual Information Meteorological Information The weather at the time of landing was reported as a sky with a few scattered clouds at 24000feet above ground level (agl), visibility 30statute miles, and the winds from 290M at 5knots.1 There are no indications that the weather conditions played a role in this incident. Aerodrome Information Runway24R is 11000feet long and 200feet wide, asphalt/concrete, and aligned along 238M. Runway inspections performed that day did not reveal any irregularity that would have affected the landing. Furthermore, the runway surface was dry at the time the occurrence aircraft landed. Land and Hold Short Operations (LAHSO) were in effect at the airport. LAHSO allow for simultaneous takeoffs and landings when a landing aircraft is able, and is specifically instructed by the controller, to hold-short of the intersecting runway/taxiway or designated hold-short point.2 If landing clearance does not contain a hold short instruction as part of the clearance, then LAHSO are not in effect. LAHSO were not used for the occurrence landing; the entire runway length was available. Crew Information The flight crew was certified and qualified for the flight in accordance with existing regulations. In the days preceding the incident, the pilot-in-command and the first officer had two and six days of rest, respectively. The crew had been on duty for approximately nine hours at the time of the occurrence. The captain had over 10000hours of total flying time. During the past 18years of his current employment, he flew as a first officer for two years on the Boeing737 (B737) and then for 12years on the Boeing 747-400 (B744).3 He was then upgraded to captain on the Airbus320 (A320) and spent four years flying that aircraft before returning to the B744 as captain. The transition training included ten line training flights, followed by a satisfactory line check that was completed on 29June2008. Following his release as a captain on the B744, he performed 18flights prior to the event flight. The event landing was his 10th landing at the controls as pilot flying (PF). The first officer had approximately 6000hours of total flying time. During the past 10years of his current employment, he spent four years on the B737 and six years as first officer on the B744. History of the Flight The flight departed Paris Charles de Gaulle International Airport (LFPG), France at 1456.4 The departure, enroute, descent, and arrival phases of the flight were uneventful and a straight-in approach to Runway24R at Montral/Pierre Elliott Trudeau International Airport (CYUL) was performed in visual meteorological conditions (VMC) with light winds. At 2144, the aircraft crossed the threshold stabilized in a flaps30 configuration with the ground spoilers armed and the autobrake system selected to position three in accordance with Air France's standard operating procedures (SOPs). The aircraft touched down within the touchdown zone of the runway, the ground spoilers automatically extended, and the thrust reversers were selected. The longitudinal deceleration was constant and the aircraft heading remained within 1 of the runway heading with small rudder inputs. Idle reverse thrust was selected at 80knots. At approximately 65knots, the captain (as the PF) placed his hand on the nose wheel tiller, which initiated a right turn that was stopped and corrected with momentary left rudder input. The aircraft then continued on the runway centreline with a slight tiller deflection forward (i.e. nose wheels turned towards the right). At approximately 45knots, as the thrust reversers were stowed and the autobrake disengaged, the aircraft veered to the right. A combination of forward nose wheel tiller and full left rudder inputs were used in an attempt to stop the turn. However, the rate of turn increased rapidly. Maximum brake pressure was then applied and the aircraft came to a complete stop at 2148 on a heading of 277M, with the nose wheels 26feet off the right side of the runway surface (see Photo1). Photo 1. Aircraft on the right side of the runway. The crew advised the tower controller that the aircraft had departed the runway surface. The inboard engines were shut down, the auxiliary power unit (APU) was started, and the remaining engines shut down at 2149. The captain initiated the alert phase5 by instructing the cabin crew, via the passenger announcement (PA) system, to take their positions and be prepared for a possible evacuation in accordance with Air France's Manuel Scurit-Sauvetage Systmes, Gnralits (MSS.GEN 07.35.02). The aircraft rescue and fire fighting (ARFF) vehicles arrived at the aircraft within two minutes of the crash alarm being triggered. Contact was established with the flight crew to confirm the fuel quantity and the number of people on board as well as to verify if medical assistance was required. The wheel brake temperatures were verified and the aircraft was declared safe to be approached by ARFF personnel. The captain then indicated the end of the alert phase to the cabin crew by using the PA system to inform the passengers that the situation was under control. The passenger transport vehicles were requested by the crew at2152 and arrived approximately 30minutes later. Post-Flight Activities Work commenced around the aircraft at approximately 2220 to prepare for the eventual tow to the ramp. Heavy equipment was manoeuvred around the aircraft and metal plates were placed behind the nose wheels, thereby covering the nose wheel tracks in the grass. This work was performed without prior consultation with the TSB investigators. Several parties involved were unsure of the obligation to protect the occurrence site, as well as the requirement to preserve evidence following a reportable aviation incident. Aroports de Montral (ADM) is responsible for the measures taken when an accident or incident occurs at CYUL. The emergency response plan (ERP) is used as a management tool of emergency measures to establish the guidelines, directives, procedures, and defines the roles and responsibilities of the principal responding agencies. The ERP manual6 in use at the time referred only to aircraft accidents and did not include provisions for dealing with reportable aviation incidents as defined by TSB regulations. Transport Canada (TC) publishes guidance within the Aeronautical Information Manual (AIM)7 stating that no person shall displace, move, or interfere with an aircraft involved in an accident. However, in the event of a reportable incident, the English version of the AIM does not specifically include any provision for the protection of the aircraft and the occurrence site. When the TSB investigators arrived on site, all the passengers and crew had disembarked from the aircraft. The aircraft was surrounded by personnel and equipment manoeuvring around the site. Aircraft Information The aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures. There was no evidence found of any airframe failure or system malfunction during the flight. Post-occurrence maintenance activity on the aircraft did not find any anomaly that would have affected the directional control of the aircraft, such as the nose wheel steering, brakes, engines, thrust reversers, spoilers, and speed brakes. Nose Wheel Steering A hydraulically powered nose wheel steering is controlled by a tiller for each pilot to provide the primary low-speed steering of the aircraft on the ground (see Photo2). A tiller movement of 150 clockwise will turn the nose wheels to the maximum steering angle of 70 to the right.8 A pointer on the tiller indicates the position relative to the neutral/centred position. A caution label is also located near the pointer, advising personnel not to hold or turn the tiller while towing the airplane (see Photo3).9 Photo 2. Location of the tillers Photo 3. Close-up of left-hand tiller The rudder pedals can be used to turn the nose wheels up to 7 in either direction and are used to maintain directional control during the landing rollout down to taxi speeds. Normal taxi speed is approximately 20knots, while allowing up to 30knots on long straight taxiways, depending on weight and taxi distance.10 According to the B744 Flight Crew Training Manual, the nose wheel steering tiller should not be used until reaching taxi speed.11 The tiller inputs override rudder pedal inputs to the nose wheel steering. The rudder pedals also deflect the rudder control surfaces, which are effective at speeds above approximately 60knots. Therefore, during the landing rollout above 60knots, the aerodynamic forces on the rudder control surfaces can override the tiller nose wheel turn commands and induce a skid of the deflected nose wheels. Boeing744 Nose Wheel Tiller The design of the B744 nose wheel steering tiller originated in the late1960s. The nose wheel steering controls required mechanical advantage while keeping the lever length to a minimum. The design considerations proposed a swivel handle to facilitate handgrip and to avoid breaking of the wrist during operation. The limited sweep clearance available for a horizontal tiller required the tiller to be placed off axis and in the vertical plane. The vertical position of the tiller requires a fore-aft movement to turn the aircraft on the ground. A forward movement of the left tiller initiates a right turn and an aft movement initiates a left turn. The tiller on the right hand side works in the opposite direction; a forward movement initiates a left turn and an aft movement initiates a right turn. Several other aircraft tiller systems operate on a horizontal plane using a left-right movement to turn the aircraft left and right. The use of a horizontal plane as opposed to a vertical plane provides additional movement compatibility.12 Transitioning from the right to left seat on the B744, or from a horizontal to vertical tiller design, increases the risk of negative transfer, which may lead to habit pattern interference, particularly when faced with time-critical situations.13 Prior to the occurrence, in the history of the B744 there have been no reported cases of loss of control on the ground related to the position and movement of the nose wheel tiller. Although a slight forward pressure on the control column is recommended during the take-off roll to increase the nose wheel adherence to the surface of the runway, there are no recommendations for this increase in pressure on the nose wheel during the landing rollout under normal conditions. However, during the initial part of the landing rollout of the occurrence flight, the control column was deflected forward (nose down) by the PF, resulting in an increased weight on the nose wheel. The forward displacement of the pilot's arm when pushing the control column to a near full forward position is equivalent to a forward movement of 50to 60 of the tiller (see Photo4), resulting in a 25to 30 nose wheel deflection to the right. Photo 4. Tiller and control column forward Airbus320 Nose Wheel Steering The aircraft previously flown by the captain, an A320, was equipped with nose wheel tillers located at knee height for both pilots (see Photo5). The tillers operate on a horizontal plane with a left-right movement to turn the aircraft on the ground. The usual handling of either tiller is to lower the arm, grasp the top of the handle, and move the tiller by moving the wrist. The position of the nose wheel tiller on the A320 aircraft is lower and further outboard in relation to the tiller on the B744. Photo 5. A320 Nose wheel tiller Autobrake The autobrake system provides five levels of aircraft deceleration rates for landing. Brake application begins when all thrust levers are in the closed position (idle), the ground mode is sensed, and the wheels have spun up. To maintain the selected deceleration rate, autobrake pressure is reduced as thrust reversers and spoilers contribute to the total deceleration. The symmetrical braking of the four main landing gear assemblies provides directional stability, resulting in a resistance to heading changes during the deceleration. The system provides braking to a complete stop or until it is disarmed. AirFrance recommends using autobrake setting three for all normal landings.14 Autobrake setting three was selected by the crew for landing and was disengaged during the rollout at 45knots using manual brake pressure, in accordance with company SOPs. Thrust Reversers Each engine is equipped with a pneumatically actuated fan air thrust reverser that is powered by bleed air from the respective engine. When the aircraft is on the ground and the forward thrust levers are in the closed position, the thrust reversers are deployed by raising the reverse thrust levers to the idle detent. When the thrust reversers are fully deployed, the thrust reverser levers can then be raised up to full reverse thrust. Reverse thrust is normally maintained until the airspeed approaches 60knots, and then reverse thrust should be reduced to reach idle reverse by taxi speed. The thrust reversers were used in compliance with AirFrance SOPs. Speed Brakes and Ground Spoilers On the ground, the speed brake lever can be moved to control the 12individual flight and ground spoiler panels to their full deflection. The system can also be armed for automatic deployment upon landing. On the event flight, the speed brakes were in the armed position for the landing and extended normally during the initial rollout. Cockpit Voice Recorder The cockpit voice recorder (CVR) was a solid-state Honeywell model SSCVR, part number980-6022-001 and serial number CVR120-04850, which records two hours of audio. Boeing offers an optional system that automatically removes power to the CVR five minutes after engine shutdown.15 On the incident aircraft, this capability was not installed, nor is there a regulatory requirement for its installation. To protect critical CVR data in the aftermath of an occurrence, the CVR circuit breaker can be pulled to deactivate the CVR, once it is safe to do so. In this occurrence the circuit breaker was not pulled, which resulted in the first 51minutes of audio following the incident to be overwritten. The CVR stopped recording approximately 171minutes after the incident. According to Air France Gnralits Oprations (GEN.OPS)16 manual, this occurrence is classified as a serious incident.17 GEN.OPS section6 gives the captain the option of preserving the CVR if he feels it is necessary for further analysis. However, the checklist in section8 requires the CVR circuit breaker to be pulled in accordance with the Techniques d'utilisation (TU) manual.18 During the post-flight activities following the event, the crew did not consult the TU manual and were unable to locate the circuit breaker. Quick Access Recorder The quick access recorder (QAR) was a Penny + Giles data recorder with part numberD51434-1 and serial number1041/08/92. The QAR does not record nose wheel steering tiller position or nose wheel deflection. No additional parameters recorded on the QAR were useful to the investigation. Digital Flight Data Recorder The digital flight data recorder (DFDR) was a solid-state Honeywell model SSFDR, part number980-4700-042 and serial numberSSFDR-09535. DFDR plots were produced for the entire flight up until approximately four minutes after the aircraft came to a stop, when all engines were shut down. Nose wheel tiller movement and nose wheel deflection are not recorded by the DFDR. Image (Video) Recording TSB Safety Recommendation A03-08 called for regulatory authorities to develop harmonized requirements to fit aircraft with image recording systems that would include imaging within the cockpit to provide investigators with a reliable and objective means of expeditiously determining what happened. This recommendation supported similar United States (U.S.) National Transportation Safety Board (NTSB) recommendations issued in 2000 (i.e., A-00-30 and A-00-31) calling for the implementation of image recording systems in aircraft operated under 14 Code of Federal Regulations Part 121, 125, or 131. In its response, TC supported the TSB's recommendation; however, harmonized requirements were not developed. The U.S. Federal Aviation Administration (FAA) supported the NTSB recommendations and produced a proof of concept, which may ultimately result in FAA rulemaking. The response to this recommendation remains assessed by the TSB as Satisfactory Intent. Runway Tire Skid Marks The nose wheel skid marks commence in a straight line on the runway centreline and remain on the centreline markings and centreline lighting over a distance of approximately 600feet. The skid marks then move towards the right edge of the runway, resulting in a total skid distance of approximately 1160feet (see Photo6). The nose wheels came to rest 26feet past the right edge of the runway. The main landing gear tire skid marks commence approximately 800feet after the nose wheels began to skid, and continued for approximately 210feet. The right main landing gear tires stopped 9feet from the edge of the runway (see Photo7). Photo 7. Main gear tire marks (heavy braking) Longitudinal g data from the DFDR corresponds to the measured skid marks on the runway surface and help to establish the timeline. In addition, lateral g DFDR information at the time the skid marks begin, combined with a slight right turn and momentary rudder deflection to the left; all confirm the synchronization of DFDR data and the runway skid marks. The synchronization of DFDR data and runways skid marks produces the following sequence of events (See Figure1): Figure 1. Landing rollout events